Public bug reported:
================================================================
1. SUMMARY
================================================================
I am reporting repeated kernel instability affecting Ubuntu 24.04 LTS
running 6.8.0-146-generic on an ASUS TUF Dash F15 laptop.
The system experiences complete freezes that require a forced restart.
Kernel logs repeatedly show reference-counting errors indicating
potential use-after-free conditions in the L2TP networking subsystem. In
multiple incidents, these warnings were accompanied or followed by
general protection faults or page faults involving the Intel i915
graphics execution path.
The failures occurred during ordinary desktop activity involving Google
Chrome, Visual Studio Code, and an L2TP/IPsec VPN configured through
NetworkManager and strongSwan.
The most significant observation is that, on October 13, 2026, the
kernel reported L2TP reference-counting errors at 03:10:06 KST, followed
approximately two seconds later by a general protection fault in
kmalloc_trace during an Intel i915 graphics operation.
A preliminary test using the previously installed kernel
6.8.0-142-generic successfully established the same VPN without
immediately reproducing the reference-counting warnings.
I suspect a kernel regression affecting L2TP session reference counting
in 6.8.0-146. However, the relationship between the L2TP warnings and
the subsequent graphics-path faults remains unconfirmed.
================================================================
2. SYSTEM INFORMATION
================================================================
Distribution: Ubuntu 24.04 LTS (Noble Numbat)
Affected kernel: 6.8.0-146-generic
Previously tested: 6.8.0-142-generic
Hardware: ASUS TUF Dash F15 FX517ZM
BIOS: FX517ZM.315, June 17, 2022
CPU platform: Intel Alder Lake-P
Integrated GPU: Intel UHD Graphics, PCI ID 8086:46a3
Integrated GPU driver: i915
Dedicated GPU: NVIDIA GeForce RTX 3060 Mobile
NVIDIA driver: 580.178.04
Display server: Xorg
VPN: NetworkManager L2TP/IPsec
IPsec implementation: strongSwan 5.9.13
Additional software: Docker, Visual Studio Code, Google Chrome, Claude Code
Additional modules: VirtualBox, librealsense2, v4l2loopback
The kernel is marked as tainted because proprietary and out-of-tree
modules are loaded. This may be relevant to the investigation and should
not be overlooked.
================================================================
3. OBSERVED BEHAVIOR
================================================================
The laptop repeatedly becomes completely unresponsive during normal
desktop operation.
Observed symptoms include:
- The graphical desktop stops responding.
- Mouse and keyboard interaction becomes unavailable or ineffective.
- Running applications stop updating.
- Switching applications or interacting with the desktop becomes impossible.
- A restart is required to recover the system.
- Kernel logs show memory-management and reference-counting errors.
The freezes have occurred while interacting with different applications,
including Google Chrome and Visual Studio Code.
One freeze occurred while using Facebook in Chrome, and another occurred
after clicking the microphone button in ChatGPT. Because the problem has
occurred during different activities, no specific browser action has
been established as the root cause.
System monitoring during troubleshooting showed substantial available
RAM and no swap exhaustion. There is no current evidence that ordinary
memory exhaustion caused the failures.
================================================================
4. CRASH TIMELINE
================================================================
INCIDENT 1: OCTOBER 12, 2026, 12:52 KST
Kernel: 6.8.0-146-generic
The system encountered a kernel page fault while Google Chrome was
executing an Intel graphics operation.
Relevant kernel messages:
BUG: unable to handle page fault for address: 00000000070eb24e
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
CPU: 3 PID: 22751 Comm: chrome:gdrv0
RIP: 0010:kmalloc_trace+0xd7/0x360
Relevant call trace:
i915_vma_work [i915]
i915_vma_pin_ww [i915]
eb_validate_vmas [i915]
i915_gem_do_execbuffer [i915]
i915_gem_execbuffer2_ioctl [i915]
drm_ioctl_kernel
drm_ioctl
__x64_sys_ioctl
The fault occurred in the kernel memory allocator while processing an
Intel graphics operation.
Separate L2TP-related kernel warnings were also observed during
troubleshooting. Their relationship to this initial graphics-path fault
has not been established.
INCIDENT 2: OCTOBER 12, 2026, 16:26 KST
Kernel: 6.8.0-146-generic
At 16:26:29, NetworkManager began activating the configured L2TP/IPsec
VPN.
At 16:26:34, strongSwan successfully established the IPsec security
association, and the L2TP session was initialized.
At 16:26:35, the kernel reported:
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 0 PID: 10 at lib/refcount.c:25
refcount_warn_saturate+0x12e/0x150
Relevant call trace:
l2tp_tunnel_get_session [l2tp_core]
l2tp_udp_recv_core [l2tp_core]
l2tp_udp_encap_recv [l2tp_core]
udp_queue_rcv_one_skb
udp_queue_rcv_skb
udp_unicast_rcv_skb
__udp4_lib_rcv
udp_rcv
ip_protocol_deliver_rcu
xfrm4_rcv_encap_finish2
xfrm_trans_reinject
process_one_work
worker_thread
Additional warnings were recorded:
refcount_t: underflow; use-after-free.
refcount_t: saturated; leaking memory.
The stack traces indicate invalid reference-count operations in the L2TP
session lifecycle.
The errors appeared immediately after the VPN session was established,
making L2TP session handling a strong candidate for further
investigation.
INCIDENT 3: OCTOBER 13, 2026, 03:10 KST
Kernel: 6.8.0-146-generic
The system again encountered serious kernel errors immediately after the
L2TP/IPsec VPN became active.
At 03:10:06:
refcount_t: addition on 0; use-after-free.
refcount_t: underflow; use-after-free.
refcount_t: saturated; leaking memory.
The corresponding traces include:
l2tp_tunnel_get_session [l2tp_core]
l2tp_session_dec_refcount [l2tp_core]
l2tp_udp_recv_core [l2tp_core]
l2tp_udp_encap_recv [l2tp_core]
xfrm4_rcv_encap_finish2
xfrm_trans_reinject
NetworkManager recorded the VPN as the default IPv4 route.
At 03:10:08, approximately two seconds after the reference-counting
warnings, the kernel reported:
general protection fault, probably for non-canonical address
0xba7328a05031cb4b
CPU: 11 PID: 16673 Comm: code
RIP: 0010:kmalloc_trace+0xd7/0x360
Relevant call trace:
i915_vma_work [i915]
i915_vma_pin_ww [i915]
eb_validate_vmas [i915]
i915_gem_do_execbuffer [i915]
i915_gem_execbuffer2_ioctl [i915]
drm_ioctl_kernel
drm_ioctl
__x64_sys_ioctl
The kernel subsequently reported:
BUG: kernel NULL pointer dereference,
address: 0000000000000708
#PF: supervisor read access in kernel mode
This incident is particularly concerning because L2TP reference-counting
warnings preceded the graphics-path general protection fault by
approximately two seconds.
One possible explanation is that earlier kernel memory corruption
affected another subsystem. However, this remains a hypothesis. The logs
do not establish whether the i915 fault was a secondary consequence or
an independent defect.
================================================================
5. OBSERVED CONDITIONS AND POTENTIAL REPRODUCTION STEPS
================================================================
The following sequence was present during multiple incidents:
1. Boot Ubuntu 24.04 LTS using 6.8.0-146-generic.
2. Start a normal graphical desktop session.
3. Run ordinary applications such as Chrome or Visual Studio Code.
4. Establish an L2TP/IPsec VPN through NetworkManager and strongSwan.
5. Observe kernel logs for reference-counting warnings.
6. Continue normal desktop activity.
The L2TP reference-counting warnings have been observed repeatedly
following VPN activation on kernel 6.8.0-146.
Complete system freezes have also occurred repeatedly, but the exact
sequence required to reproduce every freeze has not yet been isolated.
The issue has occurred under different application workloads, suggesting
that it is not specific to a single application.
A controlled reproduction on an isolated test system would be useful.
================================================================
6. KERNEL REGRESSION TESTING
================================================================
I tested the previously installed kernel:
6.8.0-142-generic
Observed results:
- Ubuntu booted successfully.
- NVIDIA driver 580.178.04 loaded successfully.
- The L2TP/IPsec VPN connected successfully.
- No immediate L2TP reference-count warnings were detected.
- Intel i915 initialized normally.
- The desktop remained responsive during the initial test.
The initial boot session lasted approximately 23 minutes.
This provides preliminary evidence of a possible regression between
Ubuntu kernel 6.8.0-142 and 6.8.0-146.
However, the older kernel has not undergone sufficient long-term testing
to establish that the issue is completely resolved.
A subsequent freeze occurred after the system had booted back into
6.8.0-146, rather than remaining on 6.8.0-142.
Therefore, the later freeze should not be interpreted as evidence that
the older kernel also reproduces the same issue.
================================================================
7. EXPECTED BEHAVIOR
================================================================
Establishing and using an L2TP/IPsec VPN should not result in:
- Kernel reference-count corruption.
- Use-after-free warnings.
- Kernel general protection faults.
- Kernel NULL-pointer dereferences.
- Graphics subsystem instability.
- Complete system freezes.
Applications using Intel graphics should continue functioning normally
while the VPN is active.
================================================================
8. ACTUAL BEHAVIOR
================================================================
The kernel repeatedly reports invalid L2TP session reference-count
operations shortly after VPN establishment.
In multiple incidents, kernel memory allocation faults have also
occurred while processing Intel graphics operations.
During the October 13 incident, L2TP reference-counting warnings were
followed approximately two seconds later by a general protection fault
in kmalloc_trace during an i915 operation.
The system subsequently became unresponsive and required a restart.
================================================================
9. ADDITIONAL OBSERVATIONS
================================================================
HYBRID GRAPHICS CONFIGURATION
The system uses both Intel integrated graphics and an NVIDIA dedicated
GPU.
The NVIDIA driver appears operational according to nvidia-smi.
No NVIDIA Xid errors were identified in the supplied crash excerpts.
The graphics-related faults occurred in the Intel i915 execution path,
although the underlying cause remains unknown.
CHROME GRAPHICS ACCELERATION
Chrome graphics acceleration was disabled during part of the
troubleshooting process.
System freezes continued afterward.
This suggests that disabling Chrome hardware acceleration alone is
insufficient to eliminate the problem.
NETWORKMANAGER DISPATCHER WARNING
A separate NetworkManager dispatcher script reported:
/etc/NetworkManager/dispatcher.d/99tlp-rdw-nm:
cannot open /usr/share/tlp/tlp-func-base
This indicates a missing dependency or outdated dispatcher script.
There is currently no evidence that this configuration issue directly
caused the kernel faults.
THIRD-PARTY KERNEL MODULES
The system has proprietary or out-of-tree modules associated with
NVIDIA, VirtualBox, RealSense, and v4l2loopback.
These modules may complicate kernel debugging.
Their presence should be considered when investigating potential memory
corruption or driver interactions.
================================================================
10. REQUEST TO MAINTAINERS
================================================================
I would appreciate assistance investigating the following questions:
1. Does Ubuntu kernel 6.8.0-146 contain a regression affecting L2TP
session reference counting?
2. Do the warnings in l2tp_tunnel_get_session and
l2tp_session_dec_refcount correspond to an already identified upstream
Linux kernel bug?
3. Could the subsequent kmalloc_trace faults in the i915 execution path
result from earlier kernel memory corruption in the L2TP subsystem?
4. Is there an upstream patch or newer supported Ubuntu kernel build
that addresses the L2TP reference-counting issue?
5. Are there additional kernel debugging options, diagnostic tools, or
controlled reproduction steps that would help isolate the underlying
defect?
I can provide full kernel journals, hardware diagnostics, installed
package information, and additional controlled tests if requested.
================================================================
11. IMPACT
================================================================
This issue significantly affects workstation reliability.
The affected laptop is used for software engineering, AI development,
and remote infrastructure access.
The L2TP/IPsec VPN is required to access development infrastructure.
Permanently disabling the VPN is therefore not a practical workaround.
Repeated complete system freezes interrupt development workflows,
require restarts, and create a risk of losing unsaved work.
A temporary rollback to kernel 6.8.0-142 is being evaluated, but a
maintained kernel containing the relevant fixes is needed.
================================================================
12. RELATED REPORTS
================================================================
I have not yet confirmed an existing Ubuntu Launchpad report describing
this exact regression.
The observed L2TP reference-counting errors may correspond to an
existing upstream Linux kernel issue, but no specific related bug has
been independently verified.
I would appreciate assistance identifying any existing reports or
patches addressing the failures in l2tp_tunnel_get_session and
l2tp_session_dec_refcount.
This report also documents subsequent faults in the Intel i915 graphics
execution path. Whether these faults share the same root cause remains
unknown.
================================================================
13. ATTACHMENTS AND DIAGNOSTIC INFORMATION
================================================================
The attached archive, ubuntu-kernel-bug-report.zip, contains:
- kernel-crash-redacted.log: Kernel crash traces from October 13, 2026, with
the hostname redacted.
- lspci-vnvn.log: Detailed PCI hardware and driver information.
- version.log: Ubuntu kernel version information collected after temporarily
switching to the older kernel.
KERNEL VERSION CLARIFICATION
The attached version.log reflects kernel 6.8.0-142-generic, which was
running when the diagnostic file was generated.
The reported kernel crashes occurred on 6.8.0-146-generic, as confirmed
by the attached crash traces.
The L2TP use-after-free warnings preceded the subsequent i915 execution
fault, but a causal relationship has not yet been established.
The attached crash log preserves the L2TP reference-counting warnings
and the Intel graphics fault stack trace. The final NULL-pointer
dereference is only partially captured because the available log ends
shortly after that error begins.
Please let me know if additional logs, reproduction tests, or hardware
diagnostics would assist the investigation.
Thank you for investigating this issue.
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Attachment added: "ubuntu-kernel-bug-report.zip"
https://bugs.launchpad.net/bugs/2170619/+attachment/6008545/+files/ubuntu-kernel-bug-report.zip
** Description changed:
- ## 1. Summary
+
+ ================================================================
+ 1. SUMMARY
+ ================================================================
I am reporting repeated kernel instability affecting Ubuntu 24.04 LTS
- running `6.8.0-146-generic` on an ASUS TUF Dash F15 laptop.
+ running 6.8.0-146-generic on an ASUS TUF Dash F15 laptop.
The system experiences complete freezes that require a forced restart.
Kernel logs repeatedly show reference-counting errors indicating
potential use-after-free conditions in the L2TP networking subsystem. In
multiple incidents, these warnings were accompanied or followed by
- general protection faults or page faults involving the Intel `i915`
+ general protection faults or page faults involving the Intel i915
graphics execution path.
The failures occurred during ordinary desktop activity involving Google
Chrome, Visual Studio Code, and an L2TP/IPsec VPN configured through
NetworkManager and strongSwan.
The most significant observation is that, on October 13, 2026, the
kernel reported L2TP reference-counting errors at 03:10:06 KST, followed
approximately two seconds later by a general protection fault in
- `kmalloc_trace` during an Intel `i915` graphics operation.
+ kmalloc_trace during an Intel i915 graphics operation.
A preliminary test using the previously installed kernel
- `6.8.0-142-generic` successfully established the same VPN without
+ 6.8.0-142-generic successfully established the same VPN without
immediately reproducing the reference-counting warnings.
I suspect a kernel regression affecting L2TP session reference counting
- in `6.8.0-146`. However, the relationship between the L2TP warnings and
+ in 6.8.0-146. However, the relationship between the L2TP warnings and
the subsequent graphics-path faults remains unconfirmed.
- ## 2. System information
-
- | Component | Details |
- |---|---|
- | Distribution | Ubuntu 24.04 LTS (Noble Numbat) |
- | Affected kernel | `6.8.0-146-generic` |
- | Previously tested kernel | `6.8.0-142-generic` |
- | Hardware | ASUS TUF Dash F15 FX517ZM |
- | BIOS | FX517ZM.315, June 17, 2022 |
- | CPU platform | Intel Alder Lake-P |
- | Integrated GPU | Intel UHD Graphics, PCI ID `8086:46a3` |
- | Integrated GPU driver | `i915` |
- | Dedicated GPU | NVIDIA GeForce RTX 3060 Mobile |
- | NVIDIA driver | `580.178.04` |
- | Display server | Xorg |
- | VPN | NetworkManager L2TP/IPsec |
- | IPsec implementation | strongSwan 5.9.13 |
- | Additional software | Docker, Visual Studio Code, Google Chrome, Claude
Code |
- | Additional kernel modules | VirtualBox, librealsense2, v4l2loopback |
+
+ ================================================================
+ 2. SYSTEM INFORMATION
+ ================================================================
+
+ Distribution: Ubuntu 24.04 LTS (Noble Numbat)
+ Affected kernel: 6.8.0-146-generic
+ Previously tested: 6.8.0-142-generic
+ Hardware: ASUS TUF Dash F15 FX517ZM
+ BIOS: FX517ZM.315, June 17, 2022
+ CPU platform: Intel Alder Lake-P
+ Integrated GPU: Intel UHD Graphics, PCI ID 8086:46a3
+ Integrated GPU driver: i915
+ Dedicated GPU: NVIDIA GeForce RTX 3060 Mobile
+ NVIDIA driver: 580.178.04
+ Display server: Xorg
+ VPN: NetworkManager L2TP/IPsec
+ IPsec implementation: strongSwan 5.9.13
+ Additional software: Docker, Visual Studio Code, Google Chrome, Claude Code
+ Additional modules: VirtualBox, librealsense2, v4l2loopback
The kernel is marked as tainted because proprietary and out-of-tree
modules are loaded. This may be relevant to the investigation and should
not be overlooked.
- ## 3. Observed behavior
+
+ ================================================================
+ 3. OBSERVED BEHAVIOR
+ ================================================================
The laptop repeatedly becomes completely unresponsive during normal
desktop operation.
Observed symptoms include:
- The graphical desktop stops responding.
- Mouse and keyboard interaction becomes unavailable or ineffective.
- Running applications stop updating.
- Switching applications or interacting with the desktop becomes impossible.
- A restart is required to recover the system.
- Kernel logs show memory-management and reference-counting errors.
The freezes have occurred while interacting with different applications,
including Google Chrome and Visual Studio Code.
One freeze occurred while using Facebook in Chrome, and another occurred
after clicking the microphone button in ChatGPT. Because the problem has
occurred during different activities, no specific browser action has
been established as the root cause.
System monitoring during troubleshooting showed substantial available
RAM and no swap exhaustion. There is no current evidence that ordinary
memory exhaustion caused the failures.
- ## 4. Crash timeline
-
- ### Incident 1: October 12, 2026, 12:52 KST
-
- **Kernel:** `6.8.0-146-generic`
+
+ ================================================================
+ 4. CRASH TIMELINE
+ ================================================================
+
+ INCIDENT 1: OCTOBER 12, 2026, 12:52 KST
+
+ Kernel: 6.8.0-146-generic
The system encountered a kernel page fault while Google Chrome was
executing an Intel graphics operation.
Relevant kernel messages:
- ```text
- BUG: unable to handle page fault for address: 00000000070eb24e
- #PF: supervisor read access in kernel mode
- #PF: error_code(0x0000) - not-present page
-
- CPU: 3 PID: 22751 Comm: chrome:gdrv0
- RIP: 0010:kmalloc_trace+0xd7/0x360
- ```
+ BUG: unable to handle page fault for address: 00000000070eb24e
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+
+ CPU: 3 PID: 22751 Comm: chrome:gdrv0
+ RIP: 0010:kmalloc_trace+0xd7/0x360
Relevant call trace:
- ```text
- i915_vma_work [i915]
- i915_vma_pin_ww [i915]
- eb_validate_vmas [i915]
- i915_gem_do_execbuffer [i915]
- i915_gem_execbuffer2_ioctl [i915]
- drm_ioctl_kernel
- drm_ioctl
- __x64_sys_ioctl
- ```
+ i915_vma_work [i915]
+ i915_vma_pin_ww [i915]
+ eb_validate_vmas [i915]
+ i915_gem_do_execbuffer [i915]
+ i915_gem_execbuffer2_ioctl [i915]
+ drm_ioctl_kernel
+ drm_ioctl
+ __x64_sys_ioctl
The fault occurred in the kernel memory allocator while processing an
Intel graphics operation.
Separate L2TP-related kernel warnings were also observed during
troubleshooting. Their relationship to this initial graphics-path fault
has not been established.
- ### Incident 2: October 12, 2026, 16:26 KST
-
- **Kernel:** `6.8.0-146-generic`
+
+ INCIDENT 2: OCTOBER 12, 2026, 16:26 KST
+
+ Kernel: 6.8.0-146-generic
At 16:26:29, NetworkManager began activating the configured L2TP/IPsec
VPN.
At 16:26:34, strongSwan successfully established the IPsec security
association, and the L2TP session was initialized.
At 16:26:35, the kernel reported:
- ```text
- refcount_t: addition on 0; use-after-free.
- WARNING: CPU: 0 PID: 10 at lib/refcount.c:25
- refcount_warn_saturate+0x12e/0x150
- ```
+ refcount_t: addition on 0; use-after-free.
+ WARNING: CPU: 0 PID: 10 at lib/refcount.c:25
+ refcount_warn_saturate+0x12e/0x150
Relevant call trace:
- ```text
- l2tp_tunnel_get_session [l2tp_core]
- l2tp_udp_recv_core [l2tp_core]
- l2tp_udp_encap_recv [l2tp_core]
- udp_queue_rcv_one_skb
- udp_queue_rcv_skb
- udp_unicast_rcv_skb
- __udp4_lib_rcv
- udp_rcv
- ip_protocol_deliver_rcu
- xfrm4_rcv_encap_finish2
- xfrm_trans_reinject
- process_one_work
- worker_thread
- ```
+ l2tp_tunnel_get_session [l2tp_core]
+ l2tp_udp_recv_core [l2tp_core]
+ l2tp_udp_encap_recv [l2tp_core]
+ udp_queue_rcv_one_skb
+ udp_queue_rcv_skb
+ udp_unicast_rcv_skb
+ __udp4_lib_rcv
+ udp_rcv
+ ip_protocol_deliver_rcu
+ xfrm4_rcv_encap_finish2
+ xfrm_trans_reinject
+ process_one_work
+ worker_thread
Additional warnings were recorded:
- ```text
- refcount_t: underflow; use-after-free.
- refcount_t: saturated; leaking memory.
- ```
+ refcount_t: underflow; use-after-free.
+ refcount_t: saturated; leaking memory.
The stack traces indicate invalid reference-count operations in the L2TP
session lifecycle.
The errors appeared immediately after the VPN session was established,
making L2TP session handling a strong candidate for further
investigation.
- ### Incident 3: October 13, 2026, 03:10 KST
-
- **Kernel:** `6.8.0-146-generic`
+
+ INCIDENT 3: OCTOBER 13, 2026, 03:10 KST
+
+ Kernel: 6.8.0-146-generic
The system again encountered serious kernel errors immediately after the
L2TP/IPsec VPN became active.
At 03:10:06:
- ```text
- refcount_t: addition on 0; use-after-free.
- refcount_t: underflow; use-after-free.
- refcount_t: saturated; leaking memory.
- ```
+ refcount_t: addition on 0; use-after-free.
+ refcount_t: underflow; use-after-free.
+ refcount_t: saturated; leaking memory.
The corresponding traces include:
- ```text
- l2tp_tunnel_get_session [l2tp_core]
- l2tp_session_dec_refcount [l2tp_core]
- l2tp_udp_recv_core [l2tp_core]
- l2tp_udp_encap_recv [l2tp_core]
- xfrm4_rcv_encap_finish2
- xfrm_trans_reinject
- ```
+ l2tp_tunnel_get_session [l2tp_core]
+ l2tp_session_dec_refcount [l2tp_core]
+ l2tp_udp_recv_core [l2tp_core]
+ l2tp_udp_encap_recv [l2tp_core]
+ xfrm4_rcv_encap_finish2
+ xfrm_trans_reinject
NetworkManager recorded the VPN as the default IPv4 route.
At 03:10:08, approximately two seconds after the reference-counting
warnings, the kernel reported:
- ```text
- general protection fault, probably for non-canonical address
- 0xba7328a05031cb4b
-
- CPU: 11 PID: 16673 Comm: code
- RIP: 0010:kmalloc_trace+0xd7/0x360
- ```
+ general protection fault, probably for non-canonical address
+ 0xba7328a05031cb4b
+
+ CPU: 11 PID: 16673 Comm: code
+ RIP: 0010:kmalloc_trace+0xd7/0x360
Relevant call trace:
- ```text
- i915_vma_work [i915]
- i915_vma_pin_ww [i915]
- eb_validate_vmas [i915]
- i915_gem_do_execbuffer [i915]
- i915_gem_execbuffer2_ioctl [i915]
- drm_ioctl_kernel
- drm_ioctl
- __x64_sys_ioctl
- ```
+ i915_vma_work [i915]
+ i915_vma_pin_ww [i915]
+ eb_validate_vmas [i915]
+ i915_gem_do_execbuffer [i915]
+ i915_gem_execbuffer2_ioctl [i915]
+ drm_ioctl_kernel
+ drm_ioctl
+ __x64_sys_ioctl
The kernel subsequently reported:
- ```text
- BUG: kernel NULL pointer dereference,
- address: 0000000000000708
-
- #PF: supervisor read access in kernel mode
- ```
+ BUG: kernel NULL pointer dereference,
+ address: 0000000000000708
+
+ #PF: supervisor read access in kernel mode
This incident is particularly concerning because L2TP reference-counting
warnings preceded the graphics-path general protection fault by
approximately two seconds.
One possible explanation is that earlier kernel memory corruption
affected another subsystem. However, this remains a hypothesis. The logs
- do not establish whether the `i915` fault was a secondary consequence or
+ do not establish whether the i915 fault was a secondary consequence or
an independent defect.
- ## 5. Observed conditions and potential reproduction steps
+
+ ================================================================
+ 5. OBSERVED CONDITIONS AND POTENTIAL REPRODUCTION STEPS
+ ================================================================
The following sequence was present during multiple incidents:
- 1. Boot Ubuntu 24.04 LTS using `6.8.0-146-generic`.
+ 1. Boot Ubuntu 24.04 LTS using 6.8.0-146-generic.
2. Start a normal graphical desktop session.
3. Run ordinary applications such as Chrome or Visual Studio Code.
4. Establish an L2TP/IPsec VPN through NetworkManager and strongSwan.
5. Observe kernel logs for reference-counting warnings.
6. Continue normal desktop activity.
The L2TP reference-counting warnings have been observed repeatedly
- following VPN activation on kernel `6.8.0-146`.
+ following VPN activation on kernel 6.8.0-146.
Complete system freezes have also occurred repeatedly, but the exact
sequence required to reproduce every freeze has not yet been isolated.
The issue has occurred under different application workloads, suggesting
that it is not specific to a single application.
A controlled reproduction on an isolated test system would be useful.
- ## 6. Kernel regression testing
+
+ ================================================================
+ 6. KERNEL REGRESSION TESTING
+ ================================================================
I tested the previously installed kernel:
- `6.8.0-142-generic`
+ 6.8.0-142-generic
Observed results:
- Ubuntu booted successfully.
- - NVIDIA driver `580.178.04` loaded successfully.
+ - NVIDIA driver 580.178.04 loaded successfully.
- The L2TP/IPsec VPN connected successfully.
- No immediate L2TP reference-count warnings were detected.
- - Intel `i915` initialized normally.
+ - Intel i915 initialized normally.
- The desktop remained responsive during the initial test.
The initial boot session lasted approximately 23 minutes.
This provides preliminary evidence of a possible regression between
- Ubuntu kernel `6.8.0-142` and `6.8.0-146`.
+ Ubuntu kernel 6.8.0-142 and 6.8.0-146.
However, the older kernel has not undergone sufficient long-term testing
to establish that the issue is completely resolved.
A subsequent freeze occurred after the system had booted back into
- `6.8.0-146`, rather than remaining on `6.8.0-142`.
+ 6.8.0-146, rather than remaining on 6.8.0-142.
Therefore, the later freeze should not be interpreted as evidence that
the older kernel also reproduces the same issue.
- ## 7. Expected behavior
+
+ ================================================================
+ 7. EXPECTED BEHAVIOR
+ ================================================================
Establishing and using an L2TP/IPsec VPN should not result in:
- Kernel reference-count corruption.
- Use-after-free warnings.
- Kernel general protection faults.
- Kernel NULL-pointer dereferences.
- Graphics subsystem instability.
- Complete system freezes.
Applications using Intel graphics should continue functioning normally
while the VPN is active.
- ## 8. Actual behavior
+
+ ================================================================
+ 8. ACTUAL BEHAVIOR
+ ================================================================
The kernel repeatedly reports invalid L2TP session reference-count
operations shortly after VPN establishment.
In multiple incidents, kernel memory allocation faults have also
occurred while processing Intel graphics operations.
During the October 13 incident, L2TP reference-counting warnings were
followed approximately two seconds later by a general protection fault
- in `kmalloc_trace` during an `i915` operation.
+ in kmalloc_trace during an i915 operation.
The system subsequently became unresponsive and required a restart.
- ## 9. Additional observations
-
- ### Hybrid graphics configuration
+
+ ================================================================
+ 9. ADDITIONAL OBSERVATIONS
+ ================================================================
+
+ HYBRID GRAPHICS CONFIGURATION
The system uses both Intel integrated graphics and an NVIDIA dedicated
GPU.
- The NVIDIA driver appears operational according to `nvidia-smi`.
+ The NVIDIA driver appears operational according to nvidia-smi.
No NVIDIA Xid errors were identified in the supplied crash excerpts.
- The graphics-related faults occurred in the Intel `i915` execution path,
+ The graphics-related faults occurred in the Intel i915 execution path,
although the underlying cause remains unknown.
- ### Chrome graphics acceleration
+
+ CHROME GRAPHICS ACCELERATION
Chrome graphics acceleration was disabled during part of the
troubleshooting process.
System freezes continued afterward.
This suggests that disabling Chrome hardware acceleration alone is
insufficient to eliminate the problem.
- ### NetworkManager dispatcher warning
+
+ NETWORKMANAGER DISPATCHER WARNING
A separate NetworkManager dispatcher script reported:
- ```text
- /etc/NetworkManager/dispatcher.d/99tlp-rdw-nm:
- cannot open /usr/share/tlp/tlp-func-base
- ```
+ /etc/NetworkManager/dispatcher.d/99tlp-rdw-nm:
+ cannot open /usr/share/tlp/tlp-func-base
This indicates a missing dependency or outdated dispatcher script.
There is currently no evidence that this configuration issue directly
caused the kernel faults.
- ### Third-party kernel modules
+
+ THIRD-PARTY KERNEL MODULES
The system has proprietary or out-of-tree modules associated with
NVIDIA, VirtualBox, RealSense, and v4l2loopback.
These modules may complicate kernel debugging.
Their presence should be considered when investigating potential memory
corruption or driver interactions.
- ## 10. Request to maintainers
+
+ ================================================================
+ 10. REQUEST TO MAINTAINERS
+ ================================================================
I would appreciate assistance investigating the following questions:
- 1. Does Ubuntu kernel `6.8.0-146` contain a regression affecting L2TP
+ 1. Does Ubuntu kernel 6.8.0-146 contain a regression affecting L2TP
session reference counting?
- 2. Do the warnings in `l2tp_tunnel_get_session` and
- `l2tp_session_dec_refcount` correspond to an already identified upstream
+ 2. Do the warnings in l2tp_tunnel_get_session and
+ l2tp_session_dec_refcount correspond to an already identified upstream
Linux kernel bug?
- 3. Could the subsequent `kmalloc_trace` faults in the `i915` execution
- path result from earlier kernel memory corruption in the L2TP subsystem?
+ 3. Could the subsequent kmalloc_trace faults in the i915 execution path
+ result from earlier kernel memory corruption in the L2TP subsystem?
4. Is there an upstream patch or newer supported Ubuntu kernel build
that addresses the L2TP reference-counting issue?
5. Are there additional kernel debugging options, diagnostic tools, or
controlled reproduction steps that would help isolate the underlying
defect?
I can provide full kernel journals, hardware diagnostics, installed
package information, and additional controlled tests if requested.
- ## 11. Impact
+
+ ================================================================
+ 11. IMPACT
+ ================================================================
This issue significantly affects workstation reliability.
The affected laptop is used for software engineering, AI development,
and remote infrastructure access.
The L2TP/IPsec VPN is required to access development infrastructure.
Permanently disabling the VPN is therefore not a practical workaround.
Repeated complete system freezes interrupt development workflows,
require restarts, and create a risk of losing unsaved work.
- A temporary rollback to kernel `6.8.0-142` is being evaluated, but a
+ A temporary rollback to kernel 6.8.0-142 is being evaluated, but a
maintained kernel containing the relevant fixes is needed.
- ## 12. Related reports
+
+ ================================================================
+ 12. RELATED REPORTS
+ ================================================================
A potentially related L2TP/IPsec regression has been reported in Ubuntu
Launchpad:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169269
The reported symptoms appear similar to the reference-counting failures
observed here.
This report provides additional evidence of subsequent kernel faults in
- the Intel `i915` graphics execution path.
+ the Intel i915 graphics execution path.
Whether the networking and graphics faults share the same underlying
cause remains unknown.
- ## 13. Attachments and diagnostic information
-
- The attached archive, `ubuntu-kernel-bug-report.zip`, contains:
-
- - `kernel-crash-redacted.log`: Kernel crash traces from October 13, 2026,
with the hostname redacted.
- - `lspci-vnvn.log`: Detailed PCI hardware and driver information.
- - `version.log`: Ubuntu kernel version information collected after
temporarily switching to the older kernel.
-
- **Kernel version clarification**
-
- The attached `version.log` reflects kernel `6.8.0-142-generic`, which
- was running when the diagnostic file was generated.
-
- The reported kernel crashes occurred on `6.8.0-146-generic`, as
- confirmed by the attached crash traces.
-
- The L2TP use-after-free warnings preceded the subsequent `i915`
- execution fault, but a causal relationship has not yet been established.
+
+ ================================================================
+ 13. ATTACHMENTS AND DIAGNOSTIC INFORMATION
+ ================================================================
+
+ The attached archive, ubuntu-kernel-bug-report.zip, contains:
+
+ - kernel-crash-redacted.log: Kernel crash traces from October 13, 2026, with
the hostname redacted.
+ - lspci-vnvn.log: Detailed PCI hardware and driver information.
+ - version.log: Ubuntu kernel version information collected after temporarily
switching to the older kernel.
+
+
+ KERNEL VERSION CLARIFICATION
+
+ The attached version.log reflects kernel 6.8.0-142-generic, which was
+ running when the diagnostic file was generated.
+
+ The reported kernel crashes occurred on 6.8.0-146-generic, as confirmed
+ by the attached crash traces.
+
+ The L2TP use-after-free warnings preceded the subsequent i915 execution
+ fault, but a causal relationship has not yet been established.
The attached crash log preserves the L2TP reference-counting warnings
and the Intel graphics fault stack trace. The final NULL-pointer
dereference is only partially captured because the available log ends
shortly after that error begins.
Please let me know if additional logs, reproduction tests, or hardware
diagnostics would assist the investigation.
Thank you for investigating this issue.
** Description changed:
-
- ================================================================
- 1. SUMMARY
- ================================================================
+ ## 1. Summary
I am reporting repeated kernel instability affecting Ubuntu 24.04 LTS
- running 6.8.0-146-generic on an ASUS TUF Dash F15 laptop.
+ running `6.8.0-146-generic` on an ASUS TUF Dash F15 laptop.
The system experiences complete freezes that require a forced restart.
Kernel logs repeatedly show reference-counting errors indicating
potential use-after-free conditions in the L2TP networking subsystem. In
multiple incidents, these warnings were accompanied or followed by
- general protection faults or page faults involving the Intel i915
+ general protection faults or page faults involving the Intel `i915`
graphics execution path.
The failures occurred during ordinary desktop activity involving Google
Chrome, Visual Studio Code, and an L2TP/IPsec VPN configured through
NetworkManager and strongSwan.
The most significant observation is that, on October 13, 2026, the
kernel reported L2TP reference-counting errors at 03:10:06 KST, followed
approximately two seconds later by a general protection fault in
- kmalloc_trace during an Intel i915 graphics operation.
+ `kmalloc_trace` during an Intel `i915` graphics operation.
A preliminary test using the previously installed kernel
- 6.8.0-142-generic successfully established the same VPN without
+ `6.8.0-142-generic` successfully established the same VPN without
immediately reproducing the reference-counting warnings.
I suspect a kernel regression affecting L2TP session reference counting
- in 6.8.0-146. However, the relationship between the L2TP warnings and
+ in `6.8.0-146`. However, the relationship between the L2TP warnings and
the subsequent graphics-path faults remains unconfirmed.
-
- ================================================================
- 2. SYSTEM INFORMATION
- ================================================================
-
- Distribution: Ubuntu 24.04 LTS (Noble Numbat)
- Affected kernel: 6.8.0-146-generic
- Previously tested: 6.8.0-142-generic
- Hardware: ASUS TUF Dash F15 FX517ZM
- BIOS: FX517ZM.315, June 17, 2022
- CPU platform: Intel Alder Lake-P
- Integrated GPU: Intel UHD Graphics, PCI ID 8086:46a3
- Integrated GPU driver: i915
- Dedicated GPU: NVIDIA GeForce RTX 3060 Mobile
- NVIDIA driver: 580.178.04
- Display server: Xorg
- VPN: NetworkManager L2TP/IPsec
- IPsec implementation: strongSwan 5.9.13
- Additional software: Docker, Visual Studio Code, Google Chrome, Claude Code
- Additional modules: VirtualBox, librealsense2, v4l2loopback
+ ## 2. System information
+
+ | Component | Details |
+ |---|---|
+ | Distribution | Ubuntu 24.04 LTS (Noble Numbat) |
+ | Affected kernel | `6.8.0-146-generic` |
+ | Previously tested kernel | `6.8.0-142-generic` |
+ | Hardware | ASUS TUF Dash F15 FX517ZM |
+ | BIOS | FX517ZM.315, June 17, 2022 |
+ | CPU platform | Intel Alder Lake-P |
+ | Integrated GPU | Intel UHD Graphics, PCI ID `8086:46a3` |
+ | Integrated GPU driver | `i915` |
+ | Dedicated GPU | NVIDIA GeForce RTX 3060 Mobile |
+ | NVIDIA driver | `580.178.04` |
+ | Display server | Xorg |
+ | VPN | NetworkManager L2TP/IPsec |
+ | IPsec implementation | strongSwan 5.9.13 |
+ | Additional software | Docker, Visual Studio Code, Google Chrome, Claude
Code |
+ | Additional kernel modules | VirtualBox, librealsense2, v4l2loopback |
The kernel is marked as tainted because proprietary and out-of-tree
modules are loaded. This may be relevant to the investigation and should
not be overlooked.
-
- ================================================================
- 3. OBSERVED BEHAVIOR
- ================================================================
+ ## 3. Observed behavior
The laptop repeatedly becomes completely unresponsive during normal
desktop operation.
Observed symptoms include:
- The graphical desktop stops responding.
- Mouse and keyboard interaction becomes unavailable or ineffective.
- Running applications stop updating.
- Switching applications or interacting with the desktop becomes impossible.
- A restart is required to recover the system.
- Kernel logs show memory-management and reference-counting errors.
The freezes have occurred while interacting with different applications,
including Google Chrome and Visual Studio Code.
One freeze occurred while using Facebook in Chrome, and another occurred
after clicking the microphone button in ChatGPT. Because the problem has
occurred during different activities, no specific browser action has
been established as the root cause.
System monitoring during troubleshooting showed substantial available
RAM and no swap exhaustion. There is no current evidence that ordinary
memory exhaustion caused the failures.
-
- ================================================================
- 4. CRASH TIMELINE
- ================================================================
-
- INCIDENT 1: OCTOBER 12, 2026, 12:52 KST
-
- Kernel: 6.8.0-146-generic
+ ## 4. Crash timeline
+
+ ### Incident 1: October 12, 2026, 12:52 KST
+
+ **Kernel:** `6.8.0-146-generic`
The system encountered a kernel page fault while Google Chrome was
executing an Intel graphics operation.
Relevant kernel messages:
- BUG: unable to handle page fault for address: 00000000070eb24e
- #PF: supervisor read access in kernel mode
- #PF: error_code(0x0000) - not-present page
-
- CPU: 3 PID: 22751 Comm: chrome:gdrv0
- RIP: 0010:kmalloc_trace+0xd7/0x360
+ ```text
+ BUG: unable to handle page fault for address: 00000000070eb24e
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+
+ CPU: 3 PID: 22751 Comm: chrome:gdrv0
+ RIP: 0010:kmalloc_trace+0xd7/0x360
+ ```
Relevant call trace:
- i915_vma_work [i915]
- i915_vma_pin_ww [i915]
- eb_validate_vmas [i915]
- i915_gem_do_execbuffer [i915]
- i915_gem_execbuffer2_ioctl [i915]
- drm_ioctl_kernel
- drm_ioctl
- __x64_sys_ioctl
+ ```text
+ i915_vma_work [i915]
+ i915_vma_pin_ww [i915]
+ eb_validate_vmas [i915]
+ i915_gem_do_execbuffer [i915]
+ i915_gem_execbuffer2_ioctl [i915]
+ drm_ioctl_kernel
+ drm_ioctl
+ __x64_sys_ioctl
+ ```
The fault occurred in the kernel memory allocator while processing an
Intel graphics operation.
Separate L2TP-related kernel warnings were also observed during
troubleshooting. Their relationship to this initial graphics-path fault
has not been established.
-
- INCIDENT 2: OCTOBER 12, 2026, 16:26 KST
-
- Kernel: 6.8.0-146-generic
+ ### Incident 2: October 12, 2026, 16:26 KST
+
+ **Kernel:** `6.8.0-146-generic`
At 16:26:29, NetworkManager began activating the configured L2TP/IPsec
VPN.
At 16:26:34, strongSwan successfully established the IPsec security
association, and the L2TP session was initialized.
At 16:26:35, the kernel reported:
- refcount_t: addition on 0; use-after-free.
- WARNING: CPU: 0 PID: 10 at lib/refcount.c:25
- refcount_warn_saturate+0x12e/0x150
+ ```text
+ refcount_t: addition on 0; use-after-free.
+ WARNING: CPU: 0 PID: 10 at lib/refcount.c:25
+ refcount_warn_saturate+0x12e/0x150
+ ```
Relevant call trace:
- l2tp_tunnel_get_session [l2tp_core]
- l2tp_udp_recv_core [l2tp_core]
- l2tp_udp_encap_recv [l2tp_core]
- udp_queue_rcv_one_skb
- udp_queue_rcv_skb
- udp_unicast_rcv_skb
- __udp4_lib_rcv
- udp_rcv
- ip_protocol_deliver_rcu
- xfrm4_rcv_encap_finish2
- xfrm_trans_reinject
- process_one_work
- worker_thread
+ ```text
+ l2tp_tunnel_get_session [l2tp_core]
+ l2tp_udp_recv_core [l2tp_core]
+ l2tp_udp_encap_recv [l2tp_core]
+ udp_queue_rcv_one_skb
+ udp_queue_rcv_skb
+ udp_unicast_rcv_skb
+ __udp4_lib_rcv
+ udp_rcv
+ ip_protocol_deliver_rcu
+ xfrm4_rcv_encap_finish2
+ xfrm_trans_reinject
+ process_one_work
+ worker_thread
+ ```
Additional warnings were recorded:
- refcount_t: underflow; use-after-free.
- refcount_t: saturated; leaking memory.
+ ```text
+ refcount_t: underflow; use-after-free.
+ refcount_t: saturated; leaking memory.
+ ```
The stack traces indicate invalid reference-count operations in the L2TP
session lifecycle.
The errors appeared immediately after the VPN session was established,
making L2TP session handling a strong candidate for further
investigation.
-
- INCIDENT 3: OCTOBER 13, 2026, 03:10 KST
-
- Kernel: 6.8.0-146-generic
+ ### Incident 3: October 13, 2026, 03:10 KST
+
+ **Kernel:** `6.8.0-146-generic`
The system again encountered serious kernel errors immediately after the
L2TP/IPsec VPN became active.
At 03:10:06:
- refcount_t: addition on 0; use-after-free.
- refcount_t: underflow; use-after-free.
- refcount_t: saturated; leaking memory.
+ ```text
+ refcount_t: addition on 0; use-after-free.
+ refcount_t: underflow; use-after-free.
+ refcount_t: saturated; leaking memory.
+ ```
The corresponding traces include:
- l2tp_tunnel_get_session [l2tp_core]
- l2tp_session_dec_refcount [l2tp_core]
- l2tp_udp_recv_core [l2tp_core]
- l2tp_udp_encap_recv [l2tp_core]
- xfrm4_rcv_encap_finish2
- xfrm_trans_reinject
+ ```text
+ l2tp_tunnel_get_session [l2tp_core]
+ l2tp_session_dec_refcount [l2tp_core]
+ l2tp_udp_recv_core [l2tp_core]
+ l2tp_udp_encap_recv [l2tp_core]
+ xfrm4_rcv_encap_finish2
+ xfrm_trans_reinject
+ ```
NetworkManager recorded the VPN as the default IPv4 route.
At 03:10:08, approximately two seconds after the reference-counting
warnings, the kernel reported:
- general protection fault, probably for non-canonical address
- 0xba7328a05031cb4b
-
- CPU: 11 PID: 16673 Comm: code
- RIP: 0010:kmalloc_trace+0xd7/0x360
+ ```text
+ general protection fault, probably for non-canonical address
+ 0xba7328a05031cb4b
+
+ CPU: 11 PID: 16673 Comm: code
+ RIP: 0010:kmalloc_trace+0xd7/0x360
+ ```
Relevant call trace:
- i915_vma_work [i915]
- i915_vma_pin_ww [i915]
- eb_validate_vmas [i915]
- i915_gem_do_execbuffer [i915]
- i915_gem_execbuffer2_ioctl [i915]
- drm_ioctl_kernel
- drm_ioctl
- __x64_sys_ioctl
+ ```text
+ i915_vma_work [i915]
+ i915_vma_pin_ww [i915]
+ eb_validate_vmas [i915]
+ i915_gem_do_execbuffer [i915]
+ i915_gem_execbuffer2_ioctl [i915]
+ drm_ioctl_kernel
+ drm_ioctl
+ __x64_sys_ioctl
+ ```
The kernel subsequently reported:
- BUG: kernel NULL pointer dereference,
- address: 0000000000000708
-
- #PF: supervisor read access in kernel mode
+ ```text
+ BUG: kernel NULL pointer dereference,
+ address: 0000000000000708
+
+ #PF: supervisor read access in kernel mode
+ ```
This incident is particularly concerning because L2TP reference-counting
warnings preceded the graphics-path general protection fault by
approximately two seconds.
One possible explanation is that earlier kernel memory corruption
affected another subsystem. However, this remains a hypothesis. The logs
- do not establish whether the i915 fault was a secondary consequence or
+ do not establish whether the `i915` fault was a secondary consequence or
an independent defect.
-
- ================================================================
- 5. OBSERVED CONDITIONS AND POTENTIAL REPRODUCTION STEPS
- ================================================================
+ ## 5. Observed conditions and potential reproduction steps
The following sequence was present during multiple incidents:
- 1. Boot Ubuntu 24.04 LTS using 6.8.0-146-generic.
+ 1. Boot Ubuntu 24.04 LTS using `6.8.0-146-generic`.
2. Start a normal graphical desktop session.
3. Run ordinary applications such as Chrome or Visual Studio Code.
4. Establish an L2TP/IPsec VPN through NetworkManager and strongSwan.
5. Observe kernel logs for reference-counting warnings.
6. Continue normal desktop activity.
The L2TP reference-counting warnings have been observed repeatedly
- following VPN activation on kernel 6.8.0-146.
+ following VPN activation on kernel `6.8.0-146`.
Complete system freezes have also occurred repeatedly, but the exact
sequence required to reproduce every freeze has not yet been isolated.
The issue has occurred under different application workloads, suggesting
that it is not specific to a single application.
A controlled reproduction on an isolated test system would be useful.
-
- ================================================================
- 6. KERNEL REGRESSION TESTING
- ================================================================
+ ## 6. Kernel regression testing
I tested the previously installed kernel:
- 6.8.0-142-generic
+ `6.8.0-142-generic`
Observed results:
- Ubuntu booted successfully.
- - NVIDIA driver 580.178.04 loaded successfully.
+ - NVIDIA driver `580.178.04` loaded successfully.
- The L2TP/IPsec VPN connected successfully.
- No immediate L2TP reference-count warnings were detected.
- - Intel i915 initialized normally.
+ - Intel `i915` initialized normally.
- The desktop remained responsive during the initial test.
The initial boot session lasted approximately 23 minutes.
This provides preliminary evidence of a possible regression between
- Ubuntu kernel 6.8.0-142 and 6.8.0-146.
+ Ubuntu kernel `6.8.0-142` and `6.8.0-146`.
However, the older kernel has not undergone sufficient long-term testing
to establish that the issue is completely resolved.
A subsequent freeze occurred after the system had booted back into
- 6.8.0-146, rather than remaining on 6.8.0-142.
+ `6.8.0-146`, rather than remaining on `6.8.0-142`.
Therefore, the later freeze should not be interpreted as evidence that
the older kernel also reproduces the same issue.
-
- ================================================================
- 7. EXPECTED BEHAVIOR
- ================================================================
+ ## 7. Expected behavior
Establishing and using an L2TP/IPsec VPN should not result in:
- Kernel reference-count corruption.
- Use-after-free warnings.
- Kernel general protection faults.
- Kernel NULL-pointer dereferences.
- Graphics subsystem instability.
- Complete system freezes.
Applications using Intel graphics should continue functioning normally
while the VPN is active.
-
- ================================================================
- 8. ACTUAL BEHAVIOR
- ================================================================
+ ## 8. Actual behavior
The kernel repeatedly reports invalid L2TP session reference-count
operations shortly after VPN establishment.
In multiple incidents, kernel memory allocation faults have also
occurred while processing Intel graphics operations.
During the October 13 incident, L2TP reference-counting warnings were
followed approximately two seconds later by a general protection fault
- in kmalloc_trace during an i915 operation.
+ in `kmalloc_trace` during an `i915` operation.
The system subsequently became unresponsive and required a restart.
-
- ================================================================
- 9. ADDITIONAL OBSERVATIONS
- ================================================================
-
- HYBRID GRAPHICS CONFIGURATION
+ ## 9. Additional observations
+
+ ### Hybrid graphics configuration
The system uses both Intel integrated graphics and an NVIDIA dedicated
GPU.
- The NVIDIA driver appears operational according to nvidia-smi.
+ The NVIDIA driver appears operational according to `nvidia-smi`.
No NVIDIA Xid errors were identified in the supplied crash excerpts.
- The graphics-related faults occurred in the Intel i915 execution path,
+ The graphics-related faults occurred in the Intel `i915` execution path,
although the underlying cause remains unknown.
-
- CHROME GRAPHICS ACCELERATION
+ ### Chrome graphics acceleration
Chrome graphics acceleration was disabled during part of the
troubleshooting process.
System freezes continued afterward.
This suggests that disabling Chrome hardware acceleration alone is
insufficient to eliminate the problem.
-
- NETWORKMANAGER DISPATCHER WARNING
+ ### NetworkManager dispatcher warning
A separate NetworkManager dispatcher script reported:
- /etc/NetworkManager/dispatcher.d/99tlp-rdw-nm:
- cannot open /usr/share/tlp/tlp-func-base
+ ```text
+ /etc/NetworkManager/dispatcher.d/99tlp-rdw-nm:
+ cannot open /usr/share/tlp/tlp-func-base
+ ```
This indicates a missing dependency or outdated dispatcher script.
There is currently no evidence that this configuration issue directly
caused the kernel faults.
-
- THIRD-PARTY KERNEL MODULES
+ ### Third-party kernel modules
The system has proprietary or out-of-tree modules associated with
NVIDIA, VirtualBox, RealSense, and v4l2loopback.
These modules may complicate kernel debugging.
Their presence should be considered when investigating potential memory
corruption or driver interactions.
-
- ================================================================
- 10. REQUEST TO MAINTAINERS
- ================================================================
+ ## 10. Request to maintainers
I would appreciate assistance investigating the following questions:
- 1. Does Ubuntu kernel 6.8.0-146 contain a regression affecting L2TP
+ 1. Does Ubuntu kernel `6.8.0-146` contain a regression affecting L2TP
session reference counting?
- 2. Do the warnings in l2tp_tunnel_get_session and
- l2tp_session_dec_refcount correspond to an already identified upstream
+ 2. Do the warnings in `l2tp_tunnel_get_session` and
+ `l2tp_session_dec_refcount` correspond to an already identified upstream
Linux kernel bug?
- 3. Could the subsequent kmalloc_trace faults in the i915 execution path
- result from earlier kernel memory corruption in the L2TP subsystem?
+ 3. Could the subsequent `kmalloc_trace` faults in the `i915` execution
+ path result from earlier kernel memory corruption in the L2TP subsystem?
4. Is there an upstream patch or newer supported Ubuntu kernel build
that addresses the L2TP reference-counting issue?
5. Are there additional kernel debugging options, diagnostic tools, or
controlled reproduction steps that would help isolate the underlying
defect?
I can provide full kernel journals, hardware diagnostics, installed
package information, and additional controlled tests if requested.
-
- ================================================================
- 11. IMPACT
- ================================================================
+ ## 11. Impact
This issue significantly affects workstation reliability.
The affected laptop is used for software engineering, AI development,
and remote infrastructure access.
The L2TP/IPsec VPN is required to access development infrastructure.
Permanently disabling the VPN is therefore not a practical workaround.
Repeated complete system freezes interrupt development workflows,
require restarts, and create a risk of losing unsaved work.
- A temporary rollback to kernel 6.8.0-142 is being evaluated, but a
+ A temporary rollback to kernel `6.8.0-142` is being evaluated, but a
maintained kernel containing the relevant fixes is needed.
-
================================================================
12. RELATED REPORTS
================================================================
- A potentially related L2TP/IPsec regression has been reported in Ubuntu
- Launchpad:
-
- https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169269
-
- The reported symptoms appear similar to the reference-counting failures
- observed here.
-
- This report provides additional evidence of subsequent kernel faults in
- the Intel i915 graphics execution path.
-
- Whether the networking and graphics faults share the same underlying
- cause remains unknown.
-
-
- ================================================================
- 13. ATTACHMENTS AND DIAGNOSTIC INFORMATION
- ================================================================
-
- The attached archive, ubuntu-kernel-bug-report.zip, contains:
-
- - kernel-crash-redacted.log: Kernel crash traces from October 13, 2026, with
the hostname redacted.
- - lspci-vnvn.log: Detailed PCI hardware and driver information.
- - version.log: Ubuntu kernel version information collected after temporarily
switching to the older kernel.
-
-
- KERNEL VERSION CLARIFICATION
-
- The attached version.log reflects kernel 6.8.0-142-generic, which was
- running when the diagnostic file was generated.
-
- The reported kernel crashes occurred on 6.8.0-146-generic, as confirmed
- by the attached crash traces.
-
- The L2TP use-after-free warnings preceded the subsequent i915 execution
- fault, but a causal relationship has not yet been established.
+ I have not yet confirmed an existing Ubuntu Launchpad report describing
+ this exact regression.
+
+ The observed L2TP reference-counting errors may correspond to an
+ existing upstream Linux kernel issue, but no specific related bug has
+ been independently verified.
+
+ I would appreciate assistance identifying any existing reports or
+ patches addressing the failures in l2tp_tunnel_get_session and
+ l2tp_session_dec_refcount.
+
+ This report also documents subsequent faults in the Intel i915 graphics
+ execution path. Whether these faults share the same root cause remains
+ unknown.
+
+ ## 13. Attachments and diagnostic information
+
+ The attached archive, `ubuntu-kernel-bug-report.zip`, contains:
+
+ - `kernel-crash-redacted.log`: Kernel crash traces from October 13, 2026,
with the hostname redacted.
+ - `lspci-vnvn.log`: Detailed PCI hardware and driver information.
+ - `version.log`: Ubuntu kernel version information collected after
temporarily switching to the older kernel.
+
+ **Kernel version clarification**
+
+ The attached `version.log` reflects kernel `6.8.0-142-generic`, which
+ was running when the diagnostic file was generated.
+
+ The reported kernel crashes occurred on `6.8.0-146-generic`, as
+ confirmed by the attached crash traces.
+
+ The L2TP use-after-free warnings preceded the subsequent `i915`
+ execution fault, but a causal relationship has not yet been established.
The attached crash log preserves the L2TP reference-counting warnings
and the Intel graphics fault stack trace. The final NULL-pointer
dereference is only partially captured because the available log ends
shortly after that error begins.
Please let me know if additional logs, reproduction tests, or hardware
diagnostics would assist the investigation.
Thank you for investigating this issue.
** Description changed:
- ## 1. Summary
+ ================================================================
+ 1. SUMMARY
+ ================================================================
I am reporting repeated kernel instability affecting Ubuntu 24.04 LTS
- running `6.8.0-146-generic` on an ASUS TUF Dash F15 laptop.
+ running 6.8.0-146-generic on an ASUS TUF Dash F15 laptop.
The system experiences complete freezes that require a forced restart.
Kernel logs repeatedly show reference-counting errors indicating
potential use-after-free conditions in the L2TP networking subsystem. In
multiple incidents, these warnings were accompanied or followed by
- general protection faults or page faults involving the Intel `i915`
+ general protection faults or page faults involving the Intel i915
graphics execution path.
The failures occurred during ordinary desktop activity involving Google
Chrome, Visual Studio Code, and an L2TP/IPsec VPN configured through
NetworkManager and strongSwan.
The most significant observation is that, on October 13, 2026, the
kernel reported L2TP reference-counting errors at 03:10:06 KST, followed
approximately two seconds later by a general protection fault in
- `kmalloc_trace` during an Intel `i915` graphics operation.
+ kmalloc_trace during an Intel i915 graphics operation.
A preliminary test using the previously installed kernel
- `6.8.0-142-generic` successfully established the same VPN without
+ 6.8.0-142-generic successfully established the same VPN without
immediately reproducing the reference-counting warnings.
I suspect a kernel regression affecting L2TP session reference counting
- in `6.8.0-146`. However, the relationship between the L2TP warnings and
+ in 6.8.0-146. However, the relationship between the L2TP warnings and
the subsequent graphics-path faults remains unconfirmed.
- ## 2. System information
-
- | Component | Details |
- |---|---|
- | Distribution | Ubuntu 24.04 LTS (Noble Numbat) |
- | Affected kernel | `6.8.0-146-generic` |
- | Previously tested kernel | `6.8.0-142-generic` |
- | Hardware | ASUS TUF Dash F15 FX517ZM |
- | BIOS | FX517ZM.315, June 17, 2022 |
- | CPU platform | Intel Alder Lake-P |
- | Integrated GPU | Intel UHD Graphics, PCI ID `8086:46a3` |
- | Integrated GPU driver | `i915` |
- | Dedicated GPU | NVIDIA GeForce RTX 3060 Mobile |
- | NVIDIA driver | `580.178.04` |
- | Display server | Xorg |
- | VPN | NetworkManager L2TP/IPsec |
- | IPsec implementation | strongSwan 5.9.13 |
- | Additional software | Docker, Visual Studio Code, Google Chrome, Claude
Code |
- | Additional kernel modules | VirtualBox, librealsense2, v4l2loopback |
+
+ ================================================================
+ 2. SYSTEM INFORMATION
+ ================================================================
+
+ Distribution: Ubuntu 24.04 LTS (Noble Numbat)
+ Affected kernel: 6.8.0-146-generic
+ Previously tested: 6.8.0-142-generic
+ Hardware: ASUS TUF Dash F15 FX517ZM
+ BIOS: FX517ZM.315, June 17, 2022
+ CPU platform: Intel Alder Lake-P
+ Integrated GPU: Intel UHD Graphics, PCI ID 8086:46a3
+ Integrated GPU driver: i915
+ Dedicated GPU: NVIDIA GeForce RTX 3060 Mobile
+ NVIDIA driver: 580.178.04
+ Display server: Xorg
+ VPN: NetworkManager L2TP/IPsec
+ IPsec implementation: strongSwan 5.9.13
+ Additional software: Docker, Visual Studio Code, Google Chrome, Claude Code
+ Additional modules: VirtualBox, librealsense2, v4l2loopback
The kernel is marked as tainted because proprietary and out-of-tree
modules are loaded. This may be relevant to the investigation and should
not be overlooked.
- ## 3. Observed behavior
+
+ ================================================================
+ 3. OBSERVED BEHAVIOR
+ ================================================================
The laptop repeatedly becomes completely unresponsive during normal
desktop operation.
Observed symptoms include:
- The graphical desktop stops responding.
- Mouse and keyboard interaction becomes unavailable or ineffective.
- Running applications stop updating.
- Switching applications or interacting with the desktop becomes impossible.
- A restart is required to recover the system.
- Kernel logs show memory-management and reference-counting errors.
The freezes have occurred while interacting with different applications,
including Google Chrome and Visual Studio Code.
One freeze occurred while using Facebook in Chrome, and another occurred
after clicking the microphone button in ChatGPT. Because the problem has
occurred during different activities, no specific browser action has
been established as the root cause.
System monitoring during troubleshooting showed substantial available
RAM and no swap exhaustion. There is no current evidence that ordinary
memory exhaustion caused the failures.
- ## 4. Crash timeline
-
- ### Incident 1: October 12, 2026, 12:52 KST
-
- **Kernel:** `6.8.0-146-generic`
+
+ ================================================================
+ 4. CRASH TIMELINE
+ ================================================================
+
+ INCIDENT 1: OCTOBER 12, 2026, 12:52 KST
+
+ Kernel: 6.8.0-146-generic
The system encountered a kernel page fault while Google Chrome was
executing an Intel graphics operation.
Relevant kernel messages:
- ```text
- BUG: unable to handle page fault for address: 00000000070eb24e
- #PF: supervisor read access in kernel mode
- #PF: error_code(0x0000) - not-present page
-
- CPU: 3 PID: 22751 Comm: chrome:gdrv0
- RIP: 0010:kmalloc_trace+0xd7/0x360
- ```
+ BUG: unable to handle page fault for address: 00000000070eb24e
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+
+ CPU: 3 PID: 22751 Comm: chrome:gdrv0
+ RIP: 0010:kmalloc_trace+0xd7/0x360
Relevant call trace:
- ```text
- i915_vma_work [i915]
- i915_vma_pin_ww [i915]
- eb_validate_vmas [i915]
- i915_gem_do_execbuffer [i915]
- i915_gem_execbuffer2_ioctl [i915]
- drm_ioctl_kernel
- drm_ioctl
- __x64_sys_ioctl
- ```
+ i915_vma_work [i915]
+ i915_vma_pin_ww [i915]
+ eb_validate_vmas [i915]
+ i915_gem_do_execbuffer [i915]
+ i915_gem_execbuffer2_ioctl [i915]
+ drm_ioctl_kernel
+ drm_ioctl
+ __x64_sys_ioctl
The fault occurred in the kernel memory allocator while processing an
Intel graphics operation.
Separate L2TP-related kernel warnings were also observed during
troubleshooting. Their relationship to this initial graphics-path fault
has not been established.
- ### Incident 2: October 12, 2026, 16:26 KST
-
- **Kernel:** `6.8.0-146-generic`
+
+ INCIDENT 2: OCTOBER 12, 2026, 16:26 KST
+
+ Kernel: 6.8.0-146-generic
At 16:26:29, NetworkManager began activating the configured L2TP/IPsec
VPN.
At 16:26:34, strongSwan successfully established the IPsec security
association, and the L2TP session was initialized.
At 16:26:35, the kernel reported:
- ```text
- refcount_t: addition on 0; use-after-free.
- WARNING: CPU: 0 PID: 10 at lib/refcount.c:25
- refcount_warn_saturate+0x12e/0x150
- ```
+ refcount_t: addition on 0; use-after-free.
+ WARNING: CPU: 0 PID: 10 at lib/refcount.c:25
+ refcount_warn_saturate+0x12e/0x150
Relevant call trace:
- ```text
- l2tp_tunnel_get_session [l2tp_core]
- l2tp_udp_recv_core [l2tp_core]
- l2tp_udp_encap_recv [l2tp_core]
- udp_queue_rcv_one_skb
- udp_queue_rcv_skb
- udp_unicast_rcv_skb
- __udp4_lib_rcv
- udp_rcv
- ip_protocol_deliver_rcu
- xfrm4_rcv_encap_finish2
- xfrm_trans_reinject
- process_one_work
- worker_thread
- ```
+ l2tp_tunnel_get_session [l2tp_core]
+ l2tp_udp_recv_core [l2tp_core]
+ l2tp_udp_encap_recv [l2tp_core]
+ udp_queue_rcv_one_skb
+ udp_queue_rcv_skb
+ udp_unicast_rcv_skb
+ __udp4_lib_rcv
+ udp_rcv
+ ip_protocol_deliver_rcu
+ xfrm4_rcv_encap_finish2
+ xfrm_trans_reinject
+ process_one_work
+ worker_thread
Additional warnings were recorded:
- ```text
- refcount_t: underflow; use-after-free.
- refcount_t: saturated; leaking memory.
- ```
+ refcount_t: underflow; use-after-free.
+ refcount_t: saturated; leaking memory.
The stack traces indicate invalid reference-count operations in the L2TP
session lifecycle.
The errors appeared immediately after the VPN session was established,
making L2TP session handling a strong candidate for further
investigation.
- ### Incident 3: October 13, 2026, 03:10 KST
-
- **Kernel:** `6.8.0-146-generic`
+
+ INCIDENT 3: OCTOBER 13, 2026, 03:10 KST
+
+ Kernel: 6.8.0-146-generic
The system again encountered serious kernel errors immediately after the
L2TP/IPsec VPN became active.
At 03:10:06:
- ```text
- refcount_t: addition on 0; use-after-free.
- refcount_t: underflow; use-after-free.
- refcount_t: saturated; leaking memory.
- ```
+ refcount_t: addition on 0; use-after-free.
+ refcount_t: underflow; use-after-free.
+ refcount_t: saturated; leaking memory.
The corresponding traces include:
- ```text
- l2tp_tunnel_get_session [l2tp_core]
- l2tp_session_dec_refcount [l2tp_core]
- l2tp_udp_recv_core [l2tp_core]
- l2tp_udp_encap_recv [l2tp_core]
- xfrm4_rcv_encap_finish2
- xfrm_trans_reinject
- ```
+ l2tp_tunnel_get_session [l2tp_core]
+ l2tp_session_dec_refcount [l2tp_core]
+ l2tp_udp_recv_core [l2tp_core]
+ l2tp_udp_encap_recv [l2tp_core]
+ xfrm4_rcv_encap_finish2
+ xfrm_trans_reinject
NetworkManager recorded the VPN as the default IPv4 route.
At 03:10:08, approximately two seconds after the reference-counting
warnings, the kernel reported:
- ```text
- general protection fault, probably for non-canonical address
- 0xba7328a05031cb4b
-
- CPU: 11 PID: 16673 Comm: code
- RIP: 0010:kmalloc_trace+0xd7/0x360
- ```
+ general protection fault, probably for non-canonical address
+ 0xba7328a05031cb4b
+
+ CPU: 11 PID: 16673 Comm: code
+ RIP: 0010:kmalloc_trace+0xd7/0x360
Relevant call trace:
- ```text
- i915_vma_work [i915]
- i915_vma_pin_ww [i915]
- eb_validate_vmas [i915]
- i915_gem_do_execbuffer [i915]
- i915_gem_execbuffer2_ioctl [i915]
- drm_ioctl_kernel
- drm_ioctl
- __x64_sys_ioctl
- ```
+ i915_vma_work [i915]
+ i915_vma_pin_ww [i915]
+ eb_validate_vmas [i915]
+ i915_gem_do_execbuffer [i915]
+ i915_gem_execbuffer2_ioctl [i915]
+ drm_ioctl_kernel
+ drm_ioctl
+ __x64_sys_ioctl
The kernel subsequently reported:
- ```text
- BUG: kernel NULL pointer dereference,
- address: 0000000000000708
-
- #PF: supervisor read access in kernel mode
- ```
+ BUG: kernel NULL pointer dereference,
+ address: 0000000000000708
+
+ #PF: supervisor read access in kernel mode
This incident is particularly concerning because L2TP reference-counting
warnings preceded the graphics-path general protection fault by
approximately two seconds.
One possible explanation is that earlier kernel memory corruption
affected another subsystem. However, this remains a hypothesis. The logs
- do not establish whether the `i915` fault was a secondary consequence or
+ do not establish whether the i915 fault was a secondary consequence or
an independent defect.
- ## 5. Observed conditions and potential reproduction steps
+
+ ================================================================
+ 5. OBSERVED CONDITIONS AND POTENTIAL REPRODUCTION STEPS
+ ================================================================
The following sequence was present during multiple incidents:
- 1. Boot Ubuntu 24.04 LTS using `6.8.0-146-generic`.
+ 1. Boot Ubuntu 24.04 LTS using 6.8.0-146-generic.
2. Start a normal graphical desktop session.
3. Run ordinary applications such as Chrome or Visual Studio Code.
4. Establish an L2TP/IPsec VPN through NetworkManager and strongSwan.
5. Observe kernel logs for reference-counting warnings.
6. Continue normal desktop activity.
The L2TP reference-counting warnings have been observed repeatedly
- following VPN activation on kernel `6.8.0-146`.
+ following VPN activation on kernel 6.8.0-146.
Complete system freezes have also occurred repeatedly, but the exact
sequence required to reproduce every freeze has not yet been isolated.
The issue has occurred under different application workloads, suggesting
that it is not specific to a single application.
A controlled reproduction on an isolated test system would be useful.
- ## 6. Kernel regression testing
+
+ ================================================================
+ 6. KERNEL REGRESSION TESTING
+ ================================================================
I tested the previously installed kernel:
- `6.8.0-142-generic`
+ 6.8.0-142-generic
Observed results:
- Ubuntu booted successfully.
- - NVIDIA driver `580.178.04` loaded successfully.
+ - NVIDIA driver 580.178.04 loaded successfully.
- The L2TP/IPsec VPN connected successfully.
- No immediate L2TP reference-count warnings were detected.
- - Intel `i915` initialized normally.
+ - Intel i915 initialized normally.
- The desktop remained responsive during the initial test.
The initial boot session lasted approximately 23 minutes.
This provides preliminary evidence of a possible regression between
- Ubuntu kernel `6.8.0-142` and `6.8.0-146`.
+ Ubuntu kernel 6.8.0-142 and 6.8.0-146.
However, the older kernel has not undergone sufficient long-term testing
to establish that the issue is completely resolved.
A subsequent freeze occurred after the system had booted back into
- `6.8.0-146`, rather than remaining on `6.8.0-142`.
+ 6.8.0-146, rather than remaining on 6.8.0-142.
Therefore, the later freeze should not be interpreted as evidence that
the older kernel also reproduces the same issue.
- ## 7. Expected behavior
+
+ ================================================================
+ 7. EXPECTED BEHAVIOR
+ ================================================================
Establishing and using an L2TP/IPsec VPN should not result in:
- Kernel reference-count corruption.
- Use-after-free warnings.
- Kernel general protection faults.
- Kernel NULL-pointer dereferences.
- Graphics subsystem instability.
- Complete system freezes.
Applications using Intel graphics should continue functioning normally
while the VPN is active.
- ## 8. Actual behavior
+
+ ================================================================
+ 8. ACTUAL BEHAVIOR
+ ================================================================
The kernel repeatedly reports invalid L2TP session reference-count
operations shortly after VPN establishment.
In multiple incidents, kernel memory allocation faults have also
occurred while processing Intel graphics operations.
During the October 13 incident, L2TP reference-counting warnings were
followed approximately two seconds later by a general protection fault
- in `kmalloc_trace` during an `i915` operation.
+ in kmalloc_trace during an i915 operation.
The system subsequently became unresponsive and required a restart.
- ## 9. Additional observations
-
- ### Hybrid graphics configuration
+
+ ================================================================
+ 9. ADDITIONAL OBSERVATIONS
+ ================================================================
+
+ HYBRID GRAPHICS CONFIGURATION
The system uses both Intel integrated graphics and an NVIDIA dedicated
GPU.
- The NVIDIA driver appears operational according to `nvidia-smi`.
+ The NVIDIA driver appears operational according to nvidia-smi.
No NVIDIA Xid errors were identified in the supplied crash excerpts.
- The graphics-related faults occurred in the Intel `i915` execution path,
+ The graphics-related faults occurred in the Intel i915 execution path,
although the underlying cause remains unknown.
- ### Chrome graphics acceleration
+
+ CHROME GRAPHICS ACCELERATION
Chrome graphics acceleration was disabled during part of the
troubleshooting process.
System freezes continued afterward.
This suggests that disabling Chrome hardware acceleration alone is
insufficient to eliminate the problem.
- ### NetworkManager dispatcher warning
+
+ NETWORKMANAGER DISPATCHER WARNING
A separate NetworkManager dispatcher script reported:
- ```text
- /etc/NetworkManager/dispatcher.d/99tlp-rdw-nm:
- cannot open /usr/share/tlp/tlp-func-base
- ```
+ /etc/NetworkManager/dispatcher.d/99tlp-rdw-nm:
+ cannot open /usr/share/tlp/tlp-func-base
This indicates a missing dependency or outdated dispatcher script.
There is currently no evidence that this configuration issue directly
caused the kernel faults.
- ### Third-party kernel modules
+
+ THIRD-PARTY KERNEL MODULES
The system has proprietary or out-of-tree modules associated with
NVIDIA, VirtualBox, RealSense, and v4l2loopback.
These modules may complicate kernel debugging.
Their presence should be considered when investigating potential memory
corruption or driver interactions.
- ## 10. Request to maintainers
+
+ ================================================================
+ 10. REQUEST TO MAINTAINERS
+ ================================================================
I would appreciate assistance investigating the following questions:
- 1. Does Ubuntu kernel `6.8.0-146` contain a regression affecting L2TP
+ 1. Does Ubuntu kernel 6.8.0-146 contain a regression affecting L2TP
session reference counting?
- 2. Do the warnings in `l2tp_tunnel_get_session` and
- `l2tp_session_dec_refcount` correspond to an already identified upstream
+ 2. Do the warnings in l2tp_tunnel_get_session and
+ l2tp_session_dec_refcount correspond to an already identified upstream
Linux kernel bug?
- 3. Could the subsequent `kmalloc_trace` faults in the `i915` execution
- path result from earlier kernel memory corruption in the L2TP subsystem?
+ 3. Could the subsequent kmalloc_trace faults in the i915 execution path
+ result from earlier kernel memory corruption in the L2TP subsystem?
4. Is there an upstream patch or newer supported Ubuntu kernel build
that addresses the L2TP reference-counting issue?
5. Are there additional kernel debugging options, diagnostic tools, or
controlled reproduction steps that would help isolate the underlying
defect?
I can provide full kernel journals, hardware diagnostics, installed
package information, and additional controlled tests if requested.
- ## 11. Impact
+
+ ================================================================
+ 11. IMPACT
+ ================================================================
This issue significantly affects workstation reliability.
The affected laptop is used for software engineering, AI development,
and remote infrastructure access.
The L2TP/IPsec VPN is required to access development infrastructure.
Permanently disabling the VPN is therefore not a practical workaround.
Repeated complete system freezes interrupt development workflows,
require restarts, and create a risk of losing unsaved work.
- A temporary rollback to kernel `6.8.0-142` is being evaluated, but a
+ A temporary rollback to kernel 6.8.0-142 is being evaluated, but a
maintained kernel containing the relevant fixes is needed.
+
================================================================
12. RELATED REPORTS
================================================================
I have not yet confirmed an existing Ubuntu Launchpad report describing
this exact regression.
The observed L2TP reference-counting errors may correspond to an
existing upstream Linux kernel issue, but no specific related bug has
been independently verified.
I would appreciate assistance identifying any existing reports or
patches addressing the failures in l2tp_tunnel_get_session and
l2tp_session_dec_refcount.
This report also documents subsequent faults in the Intel i915 graphics
execution path. Whether these faults share the same root cause remains
unknown.
- ## 13. Attachments and diagnostic information
-
- The attached archive, `ubuntu-kernel-bug-report.zip`, contains:
-
- - `kernel-crash-redacted.log`: Kernel crash traces from October 13, 2026,
with the hostname redacted.
- - `lspci-vnvn.log`: Detailed PCI hardware and driver information.
- - `version.log`: Ubuntu kernel version information collected after
temporarily switching to the older kernel.
-
- **Kernel version clarification**
-
- The attached `version.log` reflects kernel `6.8.0-142-generic`, which
- was running when the diagnostic file was generated.
-
- The reported kernel crashes occurred on `6.8.0-146-generic`, as
- confirmed by the attached crash traces.
-
- The L2TP use-after-free warnings preceded the subsequent `i915`
- execution fault, but a causal relationship has not yet been established.
+
+ ================================================================
+ 13. ATTACHMENTS AND DIAGNOSTIC INFORMATION
+ ================================================================
+
+ The attached archive, ubuntu-kernel-bug-report.zip, contains:
+
+ - kernel-crash-redacted.log: Kernel crash traces from October 13, 2026, with
the hostname redacted.
+ - lspci-vnvn.log: Detailed PCI hardware and driver information.
+ - version.log: Ubuntu kernel version information collected after temporarily
switching to the older kernel.
+
+
+ KERNEL VERSION CLARIFICATION
+
+ The attached version.log reflects kernel 6.8.0-142-generic, which was
+ running when the diagnostic file was generated.
+
+ The reported kernel crashes occurred on 6.8.0-146-generic, as confirmed
+ by the attached crash traces.
+
+ The L2TP use-after-free warnings preceded the subsequent i915 execution
+ fault, but a causal relationship has not yet been established.
The attached crash log preserves the L2TP reference-counting warnings
and the Intel graphics fault stack trace. The final NULL-pointer
dereference is only partially captured because the available log ends
shortly after that error begins.
Please let me know if additional logs, reproduction tests, or hardware
diagnostics would assist the investigation.
Thank you for investigating this issue.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2170619
Title:
[REGRESSION] Ubuntu 24.04 kernel 6.8.0-146: L2TP use-after-free
followed by i915 kernel faults and complete system freezes
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2170619/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
